motionloom 2.5.0 → 2.6.0

package/AGENTS.md

@@ -12,6 +12,8 @@ motionloom discovery check --root . --json
 
 Then follow the lifecycle in `SKILL.md`. The repository may coordinate Lottie, dotLottie, Rive, GSAP and Framer Motion, but it does not replace those runtimes. Render evidence, provenance, semantic checks and browser review are separate states. **Do not infer user approval from a passing heuristic, signature, screenshot or quality gate.**
 
+For Dev Lab work, also read [`docs/CHECKLIST.md`](docs/CHECKLIST.md) and [`docs/DEV-LAB-RUNTIME.md`](docs/DEV-LAB-RUNTIME.md). A runnable animation candidate should expose the live runtime descriptor/controls defined there; 0/50/100 PNGs remain evidence/fallback and must not be presented as an interactive runtime when live playback is available.
+
 ## Source of truth
 
 Do not duplicate or edit Agent-specific copies of the workflow. If this router conflicts with `SKILL.md`, the canonical root Skill and machine-readable schemas win. Use `references/agent-interoperability.md` for discovery details and `docs/AGENT-INTEGRATION.md` for installation examples.

package/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable MotionLoom changes are documented here. The project follows semantic
 
 ## [Unreleased]
 
+## [2.6.0] - 2026-08-21
+
+### Added
+
+- Upgrade Dev Lab from checkpoint-oriented review to an interactive live-runtime workbench with Play, Pause, Restart, scrub, frame-step, speed and loop controls plus fullscreen, zoom/fit, background, grid, bounds, baseline and pivot inspection tools.
+- Discover arbitrary project-defined actions from `devlab-runtime.json` instead of hard-coding `idle`, `walk`, `run` or `attack`; add groups/categories, tags, search, collapsible sections and review-state filters for large action libraries.
+- Add the hash-bound `devlab-state-machine.json` contract, legal transition controls, transition history and bounded multi-step review sequences for flows such as `Idle -> Run -> Attack -> Hurt -> Idle`.
+- Add strict iframe `runtime-trigger` support through `triggerTransition(request)` and portable `select-animation` transitions for sprite/clip runtimes.
+
+### Hardened
+
+- Bind declared live-runtime and state-machine bytes into the browser-review candidate so runtime drift invalidates stale review links.
+- Fail closed on unsafe/missing runtime paths, duplicate animation ids, mismatched candidate/runtime action sets and unsupported runtime triggers; a failed live runtime remains inspectable only through explicit captured-evidence fallback and cannot be approved.
+- Keep Action Library search/group/filter presentation independent from review coverage so hidden required actions do not disappear from the approval gate.
+- Count runtime-trigger transitions only after the target state is observable; never silently replace a failed runtime state transition with a clip switch.
+- Ship `runtime-bridge.js` with the npm package so installed-package iframe/state-machine review uses the same bridge as the repository harness.
+
+### Verified
+
+- Dev Lab CI covers deterministic snapshots, live sprite and iframe runtimes, a four-action interactive dogfood candidate, a twelve-action Action Library fixture, sprite state transitions, real iframe runtime-trigger transitions and browser-security smoke tests.
+- Pull requests #13, #14 and #15 passed Dev Lab Build, MotionLoom Quality, Security Analysis and Documentation and Package Hygiene before this release candidate was prepared.
+
+### Boundary
+
+- Runtime playback, action/transition/sequence coverage, successful triggers, hashes, snapshots and automated checks are evidence only. `approved` remains an explicit user decision bound to the exact candidate.
+- MotionLoom does not promote AI-generated material to artist-authored or production-approved status, and this release does not change the unsigned source-alpha status of the Apple companion apps.
+
+See the [2.6.0 release note](docs/releases/2.6.0.md) for the Dev Lab runtime contract, verification scope and trust boundaries.
+
+## [2.5.1] - 2026-08-18
+
+### Fixed
+
+- Preserve the caller's working directory through the npm CLI router, so default onboarding targets the consumer project instead of the installed package directory.
+- Ship Dev Lab assets, the runtime harness, Python requirements and optional browser runtime dependencies in the npm tarball; verify the installed package from an isolated consumer project before release.
+- Render Dev Lab metadata and checks with safe DOM APIs, enforce a same-origin script CSP, and reject invalid, terminal or expired browser-review candidates before enabling review.
+- Restrict runtime evidence cleanup to a dedicated child of an explicit policy root and preserve caller data outside that boundary.
+- Read the CLI version from `package.json` so displayed status stays aligned with release metadata.
+- Publish from GitHub Actions through npm Trusted Publishing/OIDC with a pinned compatible npm client, without a long-lived `NPM_TOKEN`; provenance is generated automatically by npm.
+
+### Verified
+
+- Pass the full Python/Node regression suite, quality and signed-attestation gate, isolated installed-package smoke test, Dev Lab browser-security smoke test, real Rive/GSAP/Framer Motion runtime capture, 6,900-case deep stress run and twelve Swift package tests.
+- Pass the pull-request Quality, Security Analysis, Documentation and Package Hygiene, Dev Lab and Apple workflows before preparing this patch release.
+
+### Boundary
+
+- This patch does not add framework capability, Apple signing, TestFlight distribution or production approval. Browser review and remote release actions remain explicit human-governed steps.
+
 ## [2.5.0] - 2026-08-17
 
 ### Added
@@ -128,9 +177,11 @@ See the [2.0.0 release note](docs/releases/2.0.0.md).
 
 The 1.5.0–1.9.0 milestones established runtime evidence, browser review, Intelligence Core, semantic lint, continuity, telemetry and trust-boundary hardening. Their detailed notes are available in [`docs/releases/`](docs/releases/).
 
-[2.2.0]: docs/releases/2.2.0.md
+[2.6.0]: docs/releases/2.6.0.md
+[2.5.1]: docs/releases/2.5.1.md
 [2.5.0]: docs/releases/2.5.0.md
 [2.4.0]: docs/releases/2.4.0.md
 [2.3.0]: docs/releases/2.3.0.md
+[2.2.0]: docs/releases/2.2.0.md
 [2.1.0]: docs/releases/2.1.0.md
 [2.0.0]: docs/releases/2.0.0.md

package/README.md

@@ -15,7 +15,7 @@ MotionLoom is an independent open-source Agent Skill for building UI motion, Lot
 
 > **MotionLoom is not an auto-approval layer.** A valid signature, a passing heuristic, or a successful render proves only the contract it checks. Visual quality, intent, accessibility and PR authorization remain reviewable human decisions.
 
-> **Release posture:** MotionLoom 2.5.0 adds an evidence-bound Agent capability card, benchmark-informed runtime discovery, and the native macOS/iOS review alpha in the GitHub source release under `apps/apple/`. The npm package remains the cross-platform Node/Python Skill and documentation surface; it does not distribute or sign the Xcode app. Verify npm/GitHub publication metadata separately; passing evidence never implies user approval.
+> **Release posture:** MotionLoom 2.6.0 upgrades Dev Lab into an interactive runtime review workbench with live playback controls, arbitrary project-defined Action Libraries and optional state/transition testing, while preserving deterministic snapshots and explicit human approval. The native macOS/iOS review app remains an unsigned source alpha under `apps/apple/`; the npm package remains the cross-platform Node/Python Skill and documentation surface. Verify npm/GitHub publication metadata separately; passing runtime evidence never implies user approval.
 
 ## Why MotionLoom
 
@@ -33,7 +33,7 @@ MotionLoom turns that fragile sequence into a bounded production system. Its dur
 | **Asset consistency** | Measured multi-frame geometry, pivot/footline stability, atlas boundaries and layered-map contracts | Treat a heuristic warning or deterministic pass as artist approval or production authorization |
 | **Runtime truth** | Lottie/dotLottie, SVG cutout rig, Rive, GSAP and Framer Motion evidence from real runtime paths | Call scaffold, static validation or a heuristic score visual approval |
 | **Agent intelligence** | Project graph, provenance, Motion IR, replay, semantic lint, continuity and fix plan | Convert confidence, benchmark output or warnings into approval |
-| **Human review** | Exact candidate URL, frame checkpoints, checklist, review artifact and handoff report in Dev Lab | Confirm, push or open a PR without explicit user authorization |
+| **Human review** | Exact candidate URL, live playback, Action Library, state/transition testing, deterministic checkpoints, checklist and review artifact in Dev Lab | Confirm, push or open a PR without explicit user authorization |
 
 ## The production contract
 
@@ -55,6 +55,16 @@ flowchart LR
 
 Every handoff is machine-readable. The typical bundle under `artifacts/<task-id>/` includes the task ledger, context hash, motion spec, manifest, runtime snapshots, telemetry, project graph, provenance, lint and continuity reports, fix plan, browser-review candidate, review decision, execution report and next-Agent handoff.
 
+## Interactive Dev Lab
+
+Dev Lab is designed to let the user inspect the same candidate behavior that MotionLoom is claiming as runtime evidence, rather than treating three screenshots as an animation review surface. A live candidate can expose Play, Pause, Restart, scrub, frame-step, speed and loop controls together with fullscreen, zoom/fit, background, grid, bounds, baseline and pivot inspection tools. Deterministic snapshots remain available as captured evidence and compatibility fallback.
+
+Actions are data-driven. `devlab-runtime.json` may declare any project-specific action vocabulary and optional groups/tags, so a character can expose `Idle`, `Walk`, `Run`, `Attack`, `Jump`, skills, reactions, emotes or domain-specific clips without a MotionLoom UI change. Dev Lab turns large sets into a searchable/filterable Action Library while keeping review coverage independent from presentation filters.
+
+When interaction between actions matters, an optional hash-bound `devlab-state-machine.json` can declare states, legal transitions and review sequences such as `Idle -> Run -> Attack -> Hurt -> Idle`. Sprite/clip candidates can use portable `select-animation` transitions; iframe runtimes can implement strict `runtime-trigger` transitions through the runtime bridge. A runtime trigger counts as inspected only after the target state is observable, and unsupported triggers are never silently replaced by clip switches.
+
+Review policy may require selected actions, transitions or sequences to be inspected before approval becomes available. **Completing playback or transition coverage does not approve the candidate.** Request Changes remains available and `approved` is still an explicit user decision. See the [Dev Lab live runtime contract](docs/DEV-LAB-RUNTIME.md) and [2.6.0 release note](docs/releases/2.6.0.md).
+
 ## Quick start
 
 ### Start once. Continue your normal work.
@@ -77,7 +87,7 @@ npx --no-install motionloom doctor             # check the installed package
 npx --no-install motionloom repair --yes       # restore only missing managed pieces
 ```
 
-MotionLoom supports **Node.js 18+** and **Python 3.11+** on Ubuntu, macOS and Windows. `npx` is the recommended first-run surface; after setup, use the project-local binary through `npx --no-install motionloom ...`. A global install remains optional, not required.
+MotionLoom's onboarding and contract CLI supports **Node.js 18+** and **Python 3.11+** on Ubuntu, macOS and Windows. Browser-runtime capture uses the separately declared optional Playwright/Vite dependencies and follows the capability contract's Node.js 22 requirement. Signed-attestation commands additionally require the Python `cryptography` package declared in the shipped `requirements.txt`; `motionloom doctor` reports missing runtime prerequisites. `npx` is the recommended first-run surface; after setup, use the project-local binary through `npx --no-install motionloom ...`. A global install remains optional, not required.
 
 ### When you begin animation work
 
@@ -175,7 +185,7 @@ MotionLoom keeps distinct layers distinct:
 | Provenance | Which source/material/product bytes were used and how they hash | That the source is appropriate beyond the declared authority/license contract |
 | Semantic lint and benchmark | Bounded rule findings, risk signals and performance measurements | Human visual quality or intent acceptance |
 | Signed attestation | A trusted signer signed the same task-bound hashes under the policy | Reviewer consent, accessibility approval or PR authorization |
-| Dev Lab review | The user saw the exact candidate and recorded a decision | A future candidate is automatically approved |
+| Dev Lab review | The user saw and interacted with the exact candidate and recorded a decision | A future candidate is automatically approved |
 
 `approval` remains `false` in attestation and verifier artifacts. The default PR mode is local-only (`OPEN_PR=0`); commit, push and pull-request operations remain explicit side effects.
 
@@ -307,6 +317,7 @@ Read [the Apple workspace guide](apps/apple/README.md), [the contract boundary](
 | Install or understand the full lifecycle | [SKILL.md](SKILL.md) |
 | Choose a runtime | [Framework selection](docs/FRAMEWORK-SELECTION.md) and [runtime capability reference](references/runtime-capability.md) |
 | Run a review-ready scene | [Production checklist](docs/CHECKLIST.md) and [browser review contract](references/browser-review-contract.md) |
+| Configure live actions, playback or state transitions in Dev Lab | [Dev Lab live runtime contract](docs/DEV-LAB-RUNTIME.md) and [2.6.0 release note](docs/releases/2.6.0.md) |
 | Understand Agent intelligence | [Intelligence Core](references/intelligence-core.md) and [roadmap](ROADMAP.md) |
 | Run labeled project evaluation | [Project corpus manifest](tests/evals/project-corpus.json) and `python3 scripts/eval-projects.py --allow-insufficient` |
 | Understand trust boundaries | [Signed attestation](references/signed-attestation.md) and [2.0.0 release note](docs/releases/2.0.0.md) |
@@ -324,6 +335,7 @@ Read [the Apple workspace guide](apps/apple/README.md), [the contract boundary](
 
 ```bash
 npm install
+python3 -m pip install --requirement requirements.txt
 python3 scripts/skill-doctor.py --json
 python3 tests/scripts/run_tests.py
 python3 scripts/eval-intelligence.py
@@ -338,17 +350,17 @@ The GitHub Actions workflow is designed to run the Project Memory and CLI contra
 
 ## Automated CI/CD
 
-MotionLoom separates verification from publication. Pull requests and pushes to `main` trigger the quality, documentation, security and relevant Dev Lab workflows when their path filters match. A weekly Dependabot job proposes dependency updates for the root package, Dev Lab and GitHub Actions. The npm release workflow is manual only, protected by the `npm-release` environment, and requires the maintainer to choose the distribution tag; GitHub release creation is an explicit input rather than an automatic side effect.
+MotionLoom separates verification from publication. Pull requests and pushes to `main` trigger the quality, documentation, security and relevant Dev Lab workflows when their path filters match. A weekly Dependabot job proposes dependency updates for the root package, Dev Lab and GitHub Actions. The npm release workflow is manual only, protected by the `npm-release` environment, and requires the maintainer to choose the distribution tag; GitHub release creation is a dispatch input rather than a consequence of ordinary CI.
 
 | Workflow | Trigger | Responsibility |
 |---|---|---|
 | `quality.yml` | Pull request, `main`, manual | Cross-platform memory/CLI matrix and full evidence-aware quality suite |
 | `docs.yml` | Documentation/package changes, `main`, manual | Internal links, metadata, workflow safety, Skill Doctor and npm tarball inspection |
 | `security.yml` | Pull request, `main`, weekly schedule, manual | Dependency review and CodeQL for JavaScript/Python |
-| `devlab.yml` | `dev-lab/**` changes, `main`, manual | Build and retain the browser review workbench artifact |
-| `release.yml` | Manual dispatch only | Regression, npm publish with provenance and optional GitHub release |
+| `devlab.yml` | `dev-lab/**` changes, `main`, manual | Build and retain the interactive browser review workbench artifacts and smoke evidence |
+| `release.yml` | Manual dispatch only | Regression, installed-package smoke, release traceability, npm Trusted Publishing with provenance and optional GitHub Release |
 
-To enable npm publication, configure a protected GitHub environment named `npm-release` and either add the `NPM_TOKEN` environment secret or configure npm trusted publishing for this repository. Each manual run must provide `release_version`; the workflow verifies package/changelog/release-note alignment before publishing. The workflow never runs on a pull request and never changes MotionLoom's user-review or approval contract.
+To enable npm publication, configure the protected GitHub environment named `npm-release` and configure npm Trusted Publishing for this repository/workflow/environment. No long-lived `NPM_TOKEN` is required or expected by the current release workflow. Each manual run provides `release_version`; the workflow verifies package/changelog/release-note alignment before publishing. The workflow never runs on a pull request and never changes MotionLoom's user-review or approval contract.
 
 ## License
 

package/SECURITY.md

@@ -4,10 +4,9 @@
 
 | Version | Security fixes |
 |---|---|
-| `2.2.x` | Release candidate; support begins on publication |
-| `2.1.x` | Current published line; supported until 2.2.0 publication |
-| `2.0.x` | Best effort while upgrading |
-| `<2.0.0` | Not supported |
+| `2.6.x` | Current supported line |
+| `2.5.x` | Previous line; security fixes are best effort while consumers upgrade |
+| `2.4.x` and earlier | Upgrade recommended; no routine support commitment |
 
 ## Reporting a vulnerability
 
@@ -19,10 +18,10 @@ If private reporting is unavailable, open a minimal issue titled **Security cont
 
 MotionLoom can read and write files in the host project, invoke runtimes and prepare Git operations. The npm CLI does not silently push, open a PR or turn evidence into approval. Treat project context, artifact bundles, trust policies, private keys and browser sessions as sensitive. Keep managed signing keys outside the repository and never use CI fixture keys as production trust anchors.
 
-Path guards, task identity, source/manifest hashes, evidence freshness, signer policy and approval invariants are security-relevant contracts. Report any bypass that allows cross-project memory, cross-task evidence, stale runtime output or unreviewed Git side effects.
+Path guards, task identity, source/manifest hashes, runtime bundle hashes, state-machine bindings, evidence freshness, signer policy and approval invariants are security-relevant contracts. Report any bypass that allows cross-project memory, cross-task evidence, stale runtime output, undeclared runtime/state-machine bytes or unreviewed Git side effects.
 
-See the [signed attestation reference](references/signed-attestation.md), [browser review contract](references/browser-review-contract.md) and [2.2.0 release note](docs/releases/2.2.0.md) for the current threat model and limitations.
+See the [signed attestation reference](references/signed-attestation.md), [browser review contract](references/browser-review-contract.md), [Dev Lab runtime contract](docs/DEV-LAB-RUNTIME.md) and [2.6.0 release note](docs/releases/2.6.0.md) for the current trust boundaries and limitations.
 
 ## CI/CD controls
 
-GitHub Actions workflows default to read-only repository permissions. The publication workflow is manual-only, uses the protected `npm-release` environment, requests OIDC only for the release job, and keeps npm credentials in environment secrets. Dependency updates are proposed by Dependabot as pull requests rather than applied directly to `main`.
+GitHub Actions workflows default to read-only repository permissions. The publication workflow is manual-only, uses the protected `npm-release` environment, requests OIDC only for the release job and publishes through npm Trusted Publishing without a long-lived `NPM_TOKEN`. npm provenance is generated by the trusted publication path. Dependency updates are proposed by Dependabot as pull requests rather than applied directly to `main`.

package/SKILL.md

@@ -7,7 +7,7 @@ description: >-
   validate, review, or deliver animation inside an existing project.
 license: MIT
 metadata:
-  version: "2.5.0"
+  version: "2.6.0"
   target_frameworks: "lottie,dotlottie,rive,gsap,framer-motion,spine,threejs"
   verified_runtimes: "lottie-json,dotlottie-package,svg-cutout-rig,rive,gsap,framer-motion"
 ---
@@ -38,10 +38,10 @@ For Agent or CI composition, consume JSON and preserve the exit code. If the pro
 6. **Bind Intelligence Core** — build a framework-neutral `motion-ir.json`, `project-graph.json`, `provenance.json`, `replay-bundle.json`, `semantic-lint-report.json` and `semantic-lint-benchmark.json` with `python3 scripts/intelligence.py`. Select only a capability registry entry whose status is `verified`, whose evidence is fresh and whose compatibility matches the target environment. A confidence score or benchmark result can prioritize investigation; neither can replace deterministic or human acceptance.
 6a. **Harden the trust boundary** — keep artifact and task bundles inside the repository/task root, reject symlinked evidence, bind replay to its exact `task_dir`, `task_id` and scene, select one deterministic report bundle per scene, and require browser candidate/review identity and expiry checks before readiness. The Dev Lab must reject cross-origin or identity-mismatched artifact bases. In strict runtime-observability runs, capture `runtime-telemetry.json` and a read-only `evidence-verifier-report.json`; verifier output must preserve `approval: false`. These checks expose risk and prevent evidence mixing, but do not turn heuristics or evidence integrity into approval.
 6b. **Attest** — derive a canonical statement from the exact scene/task hashes, sign it with an Ed25519 key through `scripts/attestation.py`, and verify it with the independent `scripts/attestation-verifier.py` against a fail-closed `trust-policy.json`. DSSE/SLSA-compatible attestation proves signer and binding integrity only; `approval` must remain `false` and never replaces user review.
-7. **Visual truth and browser review handoff** — after runtime rendering, build `visual-truth.json` from real baseline/candidate PNGs with `motionloom visual-truth build`. The contract records frame hashes, dimensions, runtime/source/manifest provenance and region-level review explanations; a changed frame means `review_required`, never automatic failure or approval. Then run `python3 scripts/review-hook.py prepare --task-dir artifacts/<task-id> --lab-url <internal-lab-url>`. The hook prepares the exact candidate and emits a JSON action for a browser-capable Agent. Trigger or suggest that Agent to open the emitted URL, inspect frames 0/50/100, scrub the timeline and ask the user to review. This is not a separate Dev Lab Skill; it is a required post-render handoff.
+7. **Visual truth and browser review handoff** — after runtime rendering, build `visual-truth.json` from real baseline/candidate PNGs with `motionloom visual-truth build`. The contract records frame hashes, dimensions, runtime/source/manifest provenance and region-level review explanations; a changed frame means `review_required`, never automatic failure or approval. Then run `python3 scripts/review-hook.py prepare --task-dir artifacts/<task-id> --lab-url <internal-lab-url>`. The hook prepares the exact candidate and emits a JSON action for a browser-capable Agent. Trigger or suggest that Agent to open the emitted URL. For live candidates, expose the declared Action Library and real playback controls (Play/Pause/Restart/scrub/frame-step/speed/loop); when `devlab-state-machine.json` is hash-bound, expose its legal transitions and required review sequences. Deterministic 0/50/100 snapshots remain evidence/fallback, not a substitute for live interaction. This is not a separate Dev Lab Skill; it is a required post-render handoff.
 
 > **Runtime-first reference:** `examples/agent-consumer/runtime-pilot/` and `src/output/runtime-pilot-framer/` demonstrate a code-authored Framer Motion lane with hash-bound Intake controls, deterministic 0/50/100 Playwright frames, strict runtime candidate validation, verifier and `approval: false` attestation before a prepared Dev Lab review. It is evidence of the pipeline, not a release approval or a substitute for an imported art package.
-8. **Review capture** — the browser Agent calls `window.__lab.getReview()` after the user approves or requests changes, then persists it with `python3 scripts/report.py review --task-dir artifacts/<task-id> --candidate-id <id> --decision approved|changes_requested --reviewer user`. A change request returns to generation; no approval means no PR.
+8. **Review capture** — the browser Agent calls `window.__lab.getReview()` after the user approves or requests changes, then persists it with `python3 scripts/report.py review --task-dir artifacts/<task-id> --candidate-id <id> --decision approved|changes_requested --reviewer user`. A change request returns to generation; no approval means no PR. Playback, action coverage, transition coverage and sequence completion remain evidence only and must never mint the user's decision.
 9. **Validate** — run `motionloom asset-provenance check --input src/output/<scene>/asset-provenance.json --root src/output/<scene> --mode runtime|production --manifest src/output/<scene>/manifest.json`, `motionloom visual-truth validate --root . --input src/output/<scene>/visual-truth.json --scene <scene> --task-id <task-id>`, `motionloom review-hook validate --task-dir artifacts/<task-id>`, `motionloom intelligence semantic-lint benchmark --task-dir artifacts/<task-id> --iterations 25 --threshold-ms 500`, `motionloom runtime-telemetry <scene> artifacts/<task-id>`, the independent attestation verifier, `motionloom report-contract --root . --scenes-file <changed-scenes> --require-attestation`, `motionloom quality-gate --scene <scene> --context <context-path> --task-dir artifacts/<task-id> --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation --require-visual-truth --require-asset-provenance`, and `motionloom doctor --json` when validating the Skill package itself.
 10. **Report** — create or update an artifact bundle with `python3 scripts/report.py`. Record facts with `report.py add`, structural defects with `report.py structure`, collect checksums with `report.py collect`, and run `report.py check` before rendering the final report. The final report must state completed, verified, not completed, blocked/failed, structure problems, browser candidate/review evidence and the recommended next Agent/Skill.
 11. **Learn** — after a user-confirmed fix or a deterministic benchmark, record it with `motionloom remediation-learning record-outcome|record-benchmark`. Run `summary` to expose correction count, first-pass acceptance, success rate, issue-class outliers and benchmark pass rate. Only `--user-confirmed` outcomes contribute to remediation acceptance metrics.
@@ -69,6 +69,7 @@ Only user-confirmed decisions and outcomes may become durable remediation memory
 - Read `references/runtime-capability.md` before claiming a framework is production-verified.
 - Read `docs/FRAMEWORK-SELECTION.md` and `docs/CATEGORIES.md` when selecting a runtime.
 - Read `docs/CHECKLIST.md` before marking a scene ready for review.
+- Read `docs/DEV-LAB-RUNTIME.md` before declaring live actions, playback controls, Action Library metadata or state/transition review flows.
 - Read `src/rig/README.md` for character body hierarchy and pose rules.
 - Read `references/dotlottie-source-notes.md` when packaging or validating `.lottie` archives.
 - Read `docs/ROADMAP-INTELLIGENCE.md` before extending graph, provenance, capability or replay behavior.
@@ -94,6 +95,7 @@ Only user-confirmed decisions and outcomes may become durable remediation memory
 - Artifact Intake is provider-neutral and hash-bound: receipt, control track, export manifest, provenance reference and adapter registry evidence must agree with the actual output bytes. Provider metadata, a prompt, a skill name, a model identifier or an adapter status cannot mint artist authority, production eligibility, runtime proof or approval.
 - A runtime candidate may become `runtime_test_ready` only when its intake and referenced consistency contracts pass. Rig compatibility must bind a supported adapter, skeleton/socket/action/event requirements and runtime evidence; `static-validated` and `scaffold` remain non-production states.
 - Browser-review candidates are single-use, time-bounded and bound to the exact task, scene and candidate identity; Dev Lab artifact/task bases must be same-origin and identity-consistent before staging a review decision.
+- Live Dev Lab review is data-driven and hash-bound: declared runtime and state-machine files must stay inside the scene, Action Library filtering must not weaken review coverage, and unsupported `runtime-trigger` transitions must fail visibly rather than silently switching clips.
 - Report completeness must select one deterministic passing task bundle per scene and fail on ambiguous ties; a valid artifact is never sufficient to bypass explicit user approval.
 - Runtime telemetry must bind task, scene, source, manifest, Motion IR and deterministic scrub points; tampered, stale, missing or cross-task telemetry is a verification failure.
 - Visual Truth must bind baseline/candidate PNG hashes, dimensions, source, manifest, runtime evidence and Motion IR where available; it explains changed regions for review but never emits approval.

package/agent-card.json

@@ -1,8 +1,8 @@
 {
   "card_version": "1.0",
   "name": "motionloom",
-  "version": "2.5.0",
-  "description": "Project-aware animation production with durable Project Memory, provider-neutral Artifact Intake, hash-bound control-to-runtime candidates, tiered asset provenance, framework-neutral motion IR, rig compatibility, runtime verification and telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, internal browser review, trust-boundary hardening and deterministic Agent handoff.",
+  "version": "2.6.0",
+  "description": "Project-aware animation production with durable Project Memory, provider-neutral Artifact Intake, hash-bound control-to-runtime candidates, tiered asset provenance, framework-neutral motion IR, rig compatibility, runtime verification and telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, interactive Dev Lab review, trust-boundary hardening and deterministic Agent handoff.",
   "capabilities": [
     "project.setup",
     "project.status",
@@ -146,8 +146,8 @@
     "network": "optional-and-declared",
     "git_commit": "explicit-confirmation",
     "git_push": "explicit-confirmation",
-    "open_pull_request": "explicit-confirmation"
-    ,"open_internal_browser": "trigger-or-suggest-after-render; user-review-required"
+    "open_pull_request": "explicit-confirmation",
+    "open_internal_browser": "trigger-or-suggest-after-render; user-review-required"
   },
   "recommended_integrations": [
     {

package/agent-surfaces.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.0",
   "name": "motionloom",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "canonical": {
     "skill": "SKILL.md",
     "agent_card": "agent-card.json",

package/bin/motionloom.mjs

@@ -8,8 +8,11 @@
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const PACKAGE = JSON.parse(readFileSync(resolve(ROOT, "package.json"), "utf8"));
+const VERSION = PACKAGE.version || "unknown";
 const PYTHON = process.env.MOTIONLOOM_PYTHON || (process.platform === "win32" ? "python" : "python3");
 
 const PYTHON_COMMANDS = {
@@ -32,8 +35,6 @@ const PYTHON_COMMANDS = {
   pr: "scripts/pr.py",
   "validate-lottie": "scripts/validate-lottie.py",
   manifest: "scripts/manifest.py",
-  test: "tests/scripts/run_tests.py",
-  "deep-audit": "tests/scripts/deep-stress.py",
   discovery: "scripts/discovery.py",
   "visual-truth": "scripts/visual-truth.py",
   "remediation-learning": "scripts/remediation-learning.py",
@@ -59,7 +60,7 @@ const COMMAND_ALIASES = {
 };
 
 function printHelp() {
-  console.log(`MotionLoom 2.4.0 — project-aware animation production and evidence contracts
+  console.log(`MotionLoom ${VERSION} — project-aware animation production and evidence contracts
 
 Usage:
   motionloom <command> [args...]
@@ -147,7 +148,7 @@ const delegatedArgs = alias
       ? ["init", ...args]
       : args;
 const result = spawnSync(executable, [resolve(ROOT, script), ...delegatedArgs], {
-  cwd: ROOT,
+  cwd: process.cwd(),
   stdio: "inherit",
   env: process.env,
 });

package/capability-registry.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "0.1",
-  "registry_id": "registry-motionloom-2.5.0",
-  "generated_at": "2026-08-17T05:39:24Z",
+  "registry_id": "registry-motionloom-2.5.1",
+  "generated_at": "2026-08-17T23:50:53Z",
   "selection_policy": {
     "require_verified": true,
     "allow_scaffold_only": false,
@@ -12,7 +12,7 @@
       "id": "runtime.lottie-json",
       "kind": "renderer",
       "status": "verified",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -30,11 +30,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -49,7 +49,7 @@
       "id": "runtime.dotlottie-package",
       "kind": "packager",
       "status": "verified",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -67,11 +67,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -86,7 +86,7 @@
       "id": "runtime.svg-cutout-rig",
       "kind": "renderer",
       "status": "verified",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -104,11 +104,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -123,7 +123,7 @@
       "id": "runtime.rive",
       "kind": "runtime-adapter",
       "status": "verified",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -141,11 +141,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -160,7 +160,7 @@
       "id": "runtime.gsap",
       "kind": "runtime-adapter",
       "status": "verified",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -178,11 +178,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -197,7 +197,7 @@
       "id": "runtime.framer-motion",
       "kind": "runtime-adapter",
       "status": "verified",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -215,11 +215,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -234,7 +234,7 @@
       "id": "runtime.spine",
       "kind": "renderer",
       "status": "scaffold_only",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -252,11 +252,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],
@@ -271,7 +271,7 @@
       "id": "runtime.threejs",
       "kind": "renderer",
       "status": "scaffold_only",
-      "adapter_version": "2.5.0",
+      "adapter_version": "2.5.1",
       "inputs": [
         "project-context",
         "motion-spec",
@@ -289,11 +289,11 @@
         ],
         "node": ">=22"
       },
-      "last_verified_at": "2026-08-17T05:39:24Z",
+      "last_verified_at": "2026-08-17T23:50:53Z",
       "evidence": [
         {
           "path": "scripts/runtime-adapters.mjs",
-          "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
           "kind": "ci"
         }
       ],